Most insurance claims are checked one at a time. Insurance fraud network analysis looks at them together, so the phones, people, clinics, lawyers, shops and bank accounts they share come into view, and an organized fraud ring shows up as one group.
This guide is for anyone who finds, works or pays for fraud cases: SIU investigators, fraud analysts, SIU managers, claims leaders, and the leaders deciding whether to automate the work. No background needed.
Imagine you handle injury claims at a car insurer in Florida. A rear-end crash comes in: three people in the car, a clinic visit within days, a lawyer's letter soon after. Nothing looks odd, so it is handled like any other claim.
Between March and October, ten more claims like it arrive. Different drivers, different adjusters, each one ordinary. What nobody sees from their own desk: one person phoned in all eleven, from one number, under three names.
11 claims1 callback phone$486,300 paid and reserved.
Seen one at a time, each claim looks fine and is paid or reserved like any other. Seen together, they form one group that is worth a look.
Insurance fraud network analysis finds that group early. A link is a reason to look, never proof of fraud.
How organized insurance fraud rings work, and how they are found
The schemes, why they stay invisible one claim at a time, the methods that reveal them, and the rules an SIU works under, explained without selling anything. If you are new to the topic, start here.
01 · In plain words
Insurance fraud network analysis in five minutes
Some insurance fraud is not one person telling one lie. It is organized: a group stages crashes, recruits passengers, sends them to the same clinics and lawyers, and files many claims. Each claim is kept small and ordinary, so it passes when it is checked on its own.
Insurers check claims one at a time because that is how claims work: one claim, one adjuster, one policy. The clues that tie a ring together sit between the claims: the same callback phone, the same clinic billing address, the same lawyer, the same card paying for new policies.
Insurance fraud network analysis draws claims and everything they touch as one network, so claims that share more than chance allows show up as one group. People also call it link analysis or fraud ring detection. It adds to scoring each claim; it does not replace it.
The life of a ring, in five steps
A crash is reportedA caller reports a rear-end crash with three people in the car.
Each claim is handled aloneAn adjuster checks this claim against this policy. It looks ordinary.
The claims share thingsThe same phone, clinic, lawyer and tow yard appear on ten other claims, mostly inside documents.
Someone looks across claimsNetwork analysis: claims drawn together by what they share. This is where the group is found, or missed.
The SIU investigates and refersAn investigator builds the case; a manager approves a report to the state fraud bureau. Often after the claims are paid.
Step 4 is the subject of this guide. Skip it, and the ring is seen late, if at all.
Four things that surprise people
Each claim in a ring is built to look ordinary
A well-run ring keeps every claim small, plausible and properly documented. Scored on its own facts, each one scores low.
The links hide in documents
The callback number sits in the first-notice call log, "referred by" on a clinic's intake form, the billing address in box 33 of the medical bill. Not in the fields most systems search.
Hospitals link everyone
A busy hospital, a national tow dispatch line or your own claims phone connects thousands of honest claims. These "hubs" are set aside first, or everything looks like one giant ring.
A link is a reason to look, not to deny
Fair-claims law treats refusing to pay without a reasonable investigation as an unfair practice.18 A shared phone starts an investigation; the adjuster keeps handling the claim.
Four words you will see on this page
Ring
A group of claims that share more people, phones or providers than chance allows. A reason to look, not a finding.
Link analysis
Drawing claims and what they share as a network, so the connections show.
Entity resolution
Deciding that differently written records are the same person, phone or place.
SIU
The insurer's special investigations unit, which investigates suspected fraud and refers cases.
In shortInstead of scoring each claim on its own, network analysis connects claims through what they share. Five jobs make it work: read the identifiers, match the variants, draw the links, set the hubs aside, and explain every group.
Insurance fraud network analysis, often called link analysis, draws claims and everything they touch as one network: people, phones, addresses, clinics, attorneys, tow yards, body shops, cards, bank accounts and vehicles. Claims that look unrelated on their own then show up as one group. It complements scoring a single claim; it does not replace it.
Two ways to look at the same claims
One claim at a time
Claim scoring and red flags
Rules and models score each claim on its own facts: a new policy, a late report, soft-tissue injuries, no police report. A well-run ring keeps each claim ordinary, so each one scores low.
Claims together
Network and link analysis
Link analysis asks what the claims share: the same callback phone, the same clinic billing address, the same attorney, the same card paying new premiums. The pattern lives between claims, not inside one.
Five things the method has to do
ReadFind the identifiersPull phones, names, addresses, providers, plates, VINs, cards and accounts out of fields and documents.
ResolveEntity resolutionDecide when records written differently are the same person, phone or place.
LinkDraw the networkConnect claims through what they share, weighting strong links above weak ones.
Set asideRemove hubsHospitals and your own call center link everyone; they are noise, not a ring.
ExplainScore and citeSay why a group was flagged, with the document behind every link.
Who uses it
Investigates
SIU investigators
Decide what becomes a lead, work the case and assemble the exhibits.
Tunes and reviews
Fraud analysts
Own the link rules and weights, review uncertain name matches, and clear groups that are innocent.
Approves and owns
SIU manager and director
Approve referrals to the state fraud bureau and law enforcement; own the anti-fraud plan. Claims leaders sponsor the work.
03 · How organized fraud works
How organized insurance fraud rings work across lines
In shortOrganized fraud is a business: someone recruits, someone bills, someone moves the money, and what works is repeated across many claims. Each scheme leaves a different kind of shared trace.
Organized insurance fraud is a business. It recruits participants, uses professionals who bill, and moves money, and it repeats what works across many claims. These are the schemes SIUs meet most, by line.
Staged and caused auto accidents
The swoop and squat (a car cuts in, another brakes hard and is rear-ended), the drive-down (a driver waves the victim into a turn, then hits them), paid passengers, and paper accidents that never happened. NICB warns of tow trucks that arrive uncalled, and commercial vehicles are a favored target 54.
Shows as: the same people, phones and providers on crashes that look unrelated
Medical mills and PIP or no-fault fraud
Clinics secretly controlled by laypeople through straw-owner licensed providers bill boilerplate treatment up to the policy limit. They cluster in no-fault states such as Florida, New York, Michigan and New Jersey. Two clinics billing from one address under different tax IDs is a classic sign.
Shows as: first visits within days of the loss, same billing address
Runners, attorneys, clinics, tow yards and body shops
Runners and cappers are paid per patient or per case to steer crash victims to network clinics and lawyers. A letter of representation arrives within days; the same tow yard and body shop appear. In one federal New York case, the organizer bribed hospital staff and 911 dispatchers for victims' details 17.
Shows as: one attorney, one tow yard, one shop across many claimants
Premium fraud and ghost brokers
Rate evasion through false garaging and unlisted drivers; fake or fraudulently obtained policies sold by unlicensed brokers; and new policies bound just before a loss and paid with one card in many names.
Shows as: one card, one phone or one address behind many new policies
Workers' compensation
Premium fraud by misclassifying workers or under-reporting payroll (CAIF puts premium avoidance at $35.1 billion a year across lines 1), alongside claimant and provider fraud.
Shows as: shared providers, shared addresses, related employers
Property, storm chasers and theft rings
After storms, contractors and public adjusters can repeat the same estimate template and even the same photos across homes. NICB told South Carolina legislators that roofing questionable claims rose 90% from 2023 to 2024 there 4. Theft rings clone VINs and route settlements to one bank account.
Shows as: identical estimates, reused photos, one payout account
The roles inside a ring
OrganizesOrganizer or controllerFunds the scheme and often secretly controls the clinics.
RecruitsRunners and cappersFind drivers and passengers, or approach real crash victims.
ClaimsParticipantsDrivers and paid passengers who report the loss and attend treatment.
BillsProfessionalsProviders, attorneys, tow yards and body shops who bill and represent.
Moves moneyMoney moversCheck cashers, shell companies and shared accounts.
When a ring is noticed, it usually moves: a new clinic, a new phone, a new name on the same address. That is why links across time matter as much as links within one month.
Public record shows rings at this scale
New York · 2012
No-fault racketeering case
Federal prosecutors charged 36 people, including 10 doctors and 3 lawyers, in a no-fault scheme on which insurers paid more than $279 million 16.
New York · 2024
About $60 million scheme
An organizer who secretly owned clinics through straw-owner doctors and steered patients to clinics and a law firm was sentenced to 10 years in June 2024 17.
New York · October 2026
Staged-crash arrests
State police and the Department of Financial Services arrested 16 people in staged-crash cases worth nearly $500,000 25.
04 · Why rings hide
Why fraud rings hide when each claim is reviewed alone
In shortEvery claim is checked on its own clock, by its own adjuster. A ring is built to pass that check. What gives it away sits across claims, and usually inside documents rather than fields.
Every claim is adjusted on its own clock, by its own adjuster, against its own policy. A ring is built to pass that review: each claim is small, plausible and properly documented. What gives it away sits across claims, and usually inside documents rather than fields.
The same five claims, seen two ways (illustration)
Swipe sideways to see the full diagram.
Where the links actually live
The link
Where it is written
Why a field-only system misses it
Callback phone
The first-notice call log or recording notes
The caller is often "a friend of the driver", not a party on the claim.
"Referred by"
The clinic's patient intake form
It arrives as a scanned page in the medical file.
Billing address
Box 33 of the CMS-1500 medical bill
Two clinics, two tax IDs, one suite.
Attorney
The letter of representation
Logged as correspondence, not as a party.
Tow yard and shop
The tow invoice and repair estimate
Vendors are paid, not linked.
Card or account
Premium payment and settlement records
Billing and claims sit in different systems.
One person, written five ways
A full name, an initial and surname, a nickname; a phone with and without dashes; "Ste" and "Suite". Exact-match searches treat each variant as a stranger.
Fix: entity resolution with a confidence on every match
Hubs link everyone
A regional hospital, your own claims line or a national tow dispatch number connects thousands of honest claims. Charts that keep them look like one giant ring.
Fix: set hubs aside, with a reason, before drawing rings
The claim clock keeps running
In Florida, PIP benefits are overdue if not paid within 30 days of written notice, unless the insurer has reasonable proof it is not responsible 19. Nobody has time to chart every claim by hand.
Fix: links found as documents arrive, not weeks later
Data integration is the known blocker
In the Coalition Against Insurance Fraud's 2019 technology study of 84 insurers, 76% reported data-integration problems, up from 64% in 2016 2.
Fix: read the documents and systems you already hold
05 · Link analysis, entity resolution
How link analysis and entity resolution find insurance fraud rings
In shortThis is the investigator's own method, done across every claim at once: work out who is who, connect the claims, ignore the places everyone shares, and say why each group stands out.
Three steps turn a pile of claims into a ranked list of groups worth a look: resolve the entities, draw and weight the links, then find dense groups with the hubs set aside. Research supports the approach: a 2022 peer-reviewed study found network features beat claim-only features for detecting insurance fraud, and combining them did best 23.
1ReadPull every identifier out of fields and documents, each with the line it came from and a confidence.
2ResolveMatch name variants, standardize phones and addresses, and keep a confidence on each match.
3Link and weighConnect claims through shared items, weighting a bank account above a clinic.
4Find and explainSet hubs aside, find groups denser than chance, and score each with why it was flagged.
Entity resolution for insurance: one caller, three names
Illustration · how three records become one entity
Swipe sideways to see the full diagram.
Good practice: merge automatically only above a high threshold, send the uncertain band to a person, and never merge across conflicting hard facts such as different dates of birth. The thresholds shown are an illustration, not an industry standard.
From a dense group to a ring score that explains itself
What makes a ring score trustworthy
Facts, not a black box. Every point comes from a named fact covering a stated number of claims.
Citations. Every link opens the document and line it was read from, so a manager or prosecutor can check it.
A threshold people set. Groups below it are kept, not drawn, and an analyst can change it with a second approver.
Cleared groups stay on record. A household that shares an address is cleared with a reason, so it is not flagged again next month.
06 · How SIUs work and refer
How an insurance SIU works: red flags, investigation and referral to the state fraud bureau
In shortAn SIU takes in red flags, builds the file, decides whether there is a case, and reports it to the state fraud bureau. Each state sets its own clock and form, and the claim keeps moving while the SIU looks.
Most insurers run special investigations units, and almost two dozen states and the District of Columbia require insurers to run programs to reduce fraud 2. Forty-two states and DC operate insurance fraud bureaus that receive insurers' reports 6. Statements in this section are As of October 2026.
1 · Detect
Red flags inAdjuster referrals, rules and scores, industry database hits, watch-list alerts.
2 · Investigate
Build the fileDocuments, recorded statements, examinations under oath, records checks, link charting.
3 · Decide
Is it a lead?The investigator decides; the SIU manager approves the referral.
4 · Refer
State fraud bureauOn the prescribed form, within the state's clock; often NICB too.
5 · Support
Law enforcementA liaison packages the timeline and numbered exhibits for prosecutors.
6 · Report
Plans and statisticsAnti-fraud plans, annual fraud data and training records.
Fraud referral requirements by state: there is no single national deadline
The NAIC Insurance Fraud Prevention Model Act (Model 680, §6) requires anyone in the business of insurance with "knowledge or a reasonable belief" of fraud to report it to the commissioner as the commissioner prescribes. It sets no deadline; it also grants civil immunity for reports made without actual malice (§7) and keeps them confidential (§8) 7. Each state sets its own clock:
State
When to report, and to whom
Source
New York
Within 30 days after determining a transaction appears fraudulent, to the superintendent (Ins. Law §405). Insurers above a size threshold must file a fraud prevention plan with a full-time SIU (§409).
In writing, not later than the 30th day after the insurer determines or reasonably suspects fraud, to the Texas Department of Insurance fraud unit (Ins. Code §701.051).
Within 60 days after an insurer reasonably suspects or knows of fraud, to the CDI Fraud Division (Ins. Code §1872.4); SIU regulations at 10 CCR §§2698.30–.43.
No day count. An insurer that knows or believes fraud has occurred must report to the DFS Division of Criminal Investigations (§626.989(6)), electronically on Form DFS-L1-1691, recording the date detected and the date reported. Every admitted insurer keeps an anti-fraud unit or contracts one, files an anti-fraud plan, and reports annual fraud data by March 1 (§626.9891).
Check the current statute and your counsel before relying on any deadline. A referral system should hold each state's clock and form as configuration, never one national number.
Claims keep moving while the SIU looks
Fair claims
A referral is not a denial
The NAIC Unfair Claims Settlement Practices Act (Model 900) lists "refusing to pay claims without conducting a reasonable investigation" as an unfair practice 18. The adjuster keeps handling the claim under the policy and the law.
Florida PIP
The clock with a fraud belief
With a reasonable belief of fraud, the insurer notifies the claimant in writing within 30 days that the claim is being investigated, has a further 60 days, and must pay or deny within 90 days of submission 19. Florida PIP remains in force after repeal bills died in 2025 and 2026 24.
What a good case lead looks like
"Linked to", never "involved in". The lead is drafted from the group and its documents, and names no suspect.
A timeline and numbered exhibits. Each exhibit opens the document it came from.
Open questions, not conclusions. For example: who holds the phone, whether the damage matches the reported speed, who owns the clinics.
People sign. The investigator saves the lead; the SIU manager approves any referral.
07 · AI governance, fair claims
AI in insurance fraud detection: the NAIC model bulletin, Colorado, and "a link is a reason to look"
In shortRegulators expect insurers to govern the AI they use for fraud detection, with people making the final decisions. Fair-claims law already says a claim cannot be refused without a reasonable investigation. So a link is a reason to look, never a reason to deny.
Regulators expect insurers to govern the AI they use in claims and fraud detection: a written program, human involvement in final decisions, controls on automation, vendor oversight, and records a regulator can ask for. Fair-claims law already forbids refusing a claim without a reasonable investigation. So a link is a reason to look, never a reason to deny. Statements in this section are As of October 2026.
NAIC · adopted December 4, 2023
Model Bulletin on the Use of AI Systems by Insurers
Expects a written AI systems program covering governance, risk management, internal audit and third-party systems, proportionate to use. Its scope names "claim administration and payment, and fraud detection". It asks insurers to weigh how far humans are involved in final decisions and to document controls on automation 20.
Adoption · October 8, 2026
29 jurisdictions
27 states, the District of Columbia and Puerto Rico have adopted the bulletin; recent adopters include Mississippi, South Carolina and North Dakota. California, Colorado, New York and Texas have their own insurance AI guidance; Florida is not listed as adopting 21.
Colorado · SB21-169
Claims management in scope
Colorado bars unfair discrimination from external data, algorithms and predictive models in any insurance practice, including claims management. Its governance regulation was extended to private passenger auto insurers effective October 15, 2025, with full compliance due July 1, 2026 22.
The bulletin does not, in its own words, ban automated adverse action; it expects human involvement and documented controls. New York's Circular Letter 7 (2024) on AI addresses underwriting and pricing, not claims 26.
Governance rules for fraud network analysis
Rule
What it means in practice
A link is a reason to look
A ring is a group of claims that share more than chance allows. Nothing is called fraud by software.
No automated adverse action
No payment is held, no claim is denied, and no one is contacted because of a link. The adjuster keeps the claim.
"Linked to" wording
Drafts say "linked to", never "involved in", and name no suspect.
Every line is cited
Each link carries the claim, the document, the page or line, and what read it.
People decide
Investigator: the lead. SIU manager: referrals. Fraud analyst: rules, weights, uncertain matches and clearing a group. Adjuster: the claim.
Need to know
Every search and expansion is logged by user, and the map shows only what the viewer may see in the claim file.
Cleared groups stay on record
Each with its reason and who cleared it, on an audit trail that cannot be edited.
Why this matters to a regulator. A cited link map gives the record the bulletin asks for: what the system read, what a person decided, and why. It also protects honest policyholders: a family that shares an address, or a patient of a busy clinic, is cleared with a reason instead of being re-flagged every month.
08 · Why it matters now
Organized fraud is large, rising in places, and now governed
In shortOrganized fraud is large, rising in some states, and now governed: AI rules for insurers name fraud detection in scope.
Six numbers that frame insurance fraud network analysis in late 2026, each with its source.
$308.6B
a year: the estimated cost of insurance fraud in the US across all lines. About $68.7B of it is Medicare and Medicaid.
of insurers used link analysis or data visualization against fraud in the Coalition Against Insurance Fraud's 2021 technology study, as predictive modeling reached 80%.
Coalition Against Insurance Fraud, published January 2022 15
29
jurisdictions have adopted the NAIC AI model bulletin, which names fraud detection in scope.
AI governance moved from guidance to adopted bulletins in 29 jurisdictions, with fraud detection named in scope 21.
Colorado's governance rules reached private passenger auto insurers, with full compliance due July 1, 2026 22.
In South Carolina, NICB reported medical-fraud questionable claims up 9% from 2023 to 2024, and runners steering accident victims to network clinics 4.
Florida renamed its fraud division the Division of Criminal Investigations, so plans and forms that cite the old name need updating 9.
A note on the numbers. No authoritative published benchmark exists for SIU caseloads, ring detection rates, typical ring size, or the hours it takes to chart a ring. A long-standing industry estimate puts fraud at about 10% of P&C losses; it traces to adjuster interviews in the late 1980s 13. This guide gives you questions and a do-it-yourself return calculator instead, in Part C.
09 · How teams do it today
Four ways insurers look for organized fraud today
In shortMost SIUs combine several of these. The real questions are whether anyone looks across claims, whether the documents are read, and how early in the life of a ring that happens.
1 · Per claim
Red flags and scores
Rules and models score each claim on its own facts: a new policy, a late report, soft-tissue injuries, no police report.
Catches
Claims that look unusual on their own
Misses
A ring built so that every claim looks ordinary
2 · By hand
Adjuster referrals and manual charting
An adjuster refers a claim; an investigator charts the links by hand from call logs, intake forms and bills.
Catches
What one investigator can trace in the time they have
Misses
Rings nobody referred, and links in files nobody opened
3 · Industry data
Databases and watch lists
Industry claims databases, NICB referrals and the insurer's own watch list of phones, people and providers.
Catches
Known names, numbers and providers, across carriers
Misses
New phones and new clinics, which rings switch to once noticed
4 · Across claims
Network analysis with the documents read
Software reads fields and documents, matches name variants, sets hubs aside and draws groups of claims that share too much. Several vendors offer it.
Catches
Groups whose links sit between claims and inside documents
Watch for
Whether every link is cited, and whether a link alone can hold a payment
Manual charting and network analysis, side by side
Question
Manual charting
Network analysis across claims
Which claims are looked at?
The ones someone referred
Every claim in the look-back period
Where do links come from?
Whatever the investigator reads and remembers
Fields and documents, each link tied to its line
Name variants?
Spotted by eye, or missed
Matched with a confidence; uncertain ones go to a person
Hospitals and call centers?
Clutter the chart
Set aside as hubs, with a reason
When is the ring seen?
Often after the claims are paid
As documents arrive, while more is still reserved
What is left behind?
A chart and notes
A cited record of every link and every decision
Whichever way you look, people decide: an investigator decides what becomes a lead, a manager approves each referral, and the adjuster keeps the claim.
Who is involved, and what each cares about
SI
SIU investigator
Decides what becomes a lead, works the case and assembles the exhibits. Cares about seeing the whole ring, with proof for every link.
FA
Fraud analyst
Owns link rules and weights, reviews uncertain name matches and clears groups that are innocent. Cares about fewer false alarms.
SM
SIU manager or director
Approves referrals to the state fraud bureau and law enforcement, and owns the anti-fraud plan. Cares about deadlines and quality.
AD
Adjuster
Handles the claim under the policy and the law. Cares that an alert never holds a fair payment.
CL
Claims leader
Usually sponsors the work. Cares about losses, fairness to honest customers, and what regulators will ask.
LC
Legal, compliance and privacy
Decide what data may be used for matching and shared, and own the AI governance program.
Part B · See it working
Botminds Fraud Network Analysis, one ring at a time
Part A described the problem without naming a product. This part shows how Botminds solves it, at a fictional insurer, Keywater Insurance Company, and its South Florida SIU. Every name, claim, phone number and amount in the screens is sample data, and names are blurred.
10 · One ring, start to finish
Follow one claim until the ring behind it shows
In shortThis is the example from the top of the page, inside the product. Agents read the documents, match the names and draw the ring. People decide what becomes a lead, and every link opens the page it came from.
1
One claim, before anyone looks across
A rear-end crash with three people in the car, filed under Florida's no-fault injury cover. On its own, it looks like any other claim.
The badges are the first hint: the callback phone is on 10 other claims, the attorney on 8, the clinic and the tow yard on 7 each.
One claim on its own. Its people, phone, clinic, attorney, tow yard, card and policy, each with a count of the other claims it touches.
2
The links are read from the documents
The agents read the first-notice call log and pull out the callback number, the caller and the tow yard, each with a confidence and the line it came from.
The same phone is on 10 other first-notice calls. The same caller, under three different names, is matched as one person, and a fraud analyst confirms the match.
Read from the documents. The call log, with what was found in the margin: the phone on 10 other first-notice calls (0.99), the same caller (0.96), the tow yard on 7 other claims (0.97).
3
One phone becomes a ring
Expand the callback number and the map searches 212,406 claims, matches the three names to one caller, and pulls in what the claims share: two clinics at one billing address, one attorney, one tow yard, one card.
The overnight run had already drawn it: ring R-14, 11 claims, 31 people, $486,300 paid and reserved.
One phone becomes a ring. Eleven claims, drawn together by what they share. Every line opens its source.
4
The investigator decides, the manager approves
The lead is drafted from the ring and its documents, in "linked to" wording, with no suspect named. It carries a timeline, numbered exhibits and open questions, not conclusions.
The investigator saves it. The SIU manager approves any referral, and the liaison files it on the state's form. No payment is held and no one is contacted because of a link.
"Linked to", never "involved in". The draft, the approval track and the numbered exhibits, each opening its document.
11 · Every screen
The rest of the work: asking, scoring, weighing, clearing
In shortOne ring is the story. These screens show the rest: plain-words questions with cited answers, why a ring was flagged, the settings a fraud analyst owns, and honest groups cleared so they are not flagged again.
Ask in plain words, get a cited answer. "What links this claim to other claims?" Six things, each with a numbered source, the claims involved and the documents behind them. Save the answer to the lead or show it on the map.
The ring, explained. Eleven losses on a timeline, and a grid of what each claim shares: phone, clinics, attorney, tow yard, a recently bound policy, the card, the address. Totals: $142,600 paid and $343,700 reserved.
Three names, one caller. The phone is the callback on 11 first-notice calls and the referral on 6 intake forms, and on no policy, bill or payment. Each link says where it was read.
A score you can read. Six facts, each with how many claims it covers and its points, add up to 94. Each fact opens its documents. Sample data.
Weigh the links. A shared bank account says more than a shared clinic: many honest patients share a clinic. Weights are versioned, and a change needs two people. Sample settings.
Set the hubs aside. Anything linked to more than 400 claims, the insurer's own numbers and addresses, and national tow and glass dispatch lines are removed before rings are drawn. Sample settings.
Every line opens its document. The clinic's intake form, page 1 of 3: the "referred by" line carries the first-notice caller's phone. Fictional; names blurred.
Open questions, not conclusions. Who holds the phone; whether the damage matches the reported speed; who owns the two clinics, from state corporate records, to confirm.
Rings, ranked, with the rule on the screen. "A ring is a reason to look, not a finding." The agents never hold a payment or contact anyone; the investigator decides what becomes a lead. Fictional sample data.
Cleared with a reason, kept on record. Three claims by one household over 30 months, no shared providers: cleared by a fraud analyst, and not flagged again.
Select any screen to open it full size. Keywater Insurance Company and every claim, phone number and amount are fictional; names of people and businesses are blurred.
12 · Agents, and who decides
Six agents do the reading and drawing. Four people make the decisions.
In shortEach agent has one job and one thing it never does. Investigators decide leads, managers approve referrals, analysts own the rules and adjusters keep the claim. No agent holds a payment or contacts anyone.
The six agents
Link reader
Reads first-notice logs, PIP applications, intake forms, medical bills, letters, police reports, tow invoices and payments; pulls out each identifier with its line and a confidence.
Never invents an identifier, or reads outside the claim file.
Entity resolver
Decides when names, phones and addresses written differently are one person or place, and standardizes them.
Never merges uncertain matches without the fraud analyst, or across different dates of birth.
Ring finder
Each night finds dense groups of claims, sets hubs aside, then scores and labels each ring with claims, people, dollars and why it was flagged.
Never calls a ring fraud, holds a payment or contacts anyone.
Question answerer
Turns a plain question into a map search and puts a citation on every sentence.
Never answers beyond what the map and documents show.
Lead writer
Drafts the case lead: summary, timeline, numbered exhibits and open questions, in "linked to" wording.
Never sends a lead or referral, or names a suspect.
Watch-list monitor
Checks every new first-notice call, bill and payment against the watch list and alerts the investigator and the adjuster.
Never stops a claim or a payment: it alerts only.
People decide; everything is cited
Decides the leadSIU investigatorOpens the case from a ring or an answer, and saves the lead.
Approves referralsSIU managerApproves every referral to the state fraud bureau and law enforcement.
Owns the rulesFraud analystApproves weights, hubs and uncertain matches, and clears groups with a reason; rule changes need the manager too.
Keeps the claimAdjusterHandles every claim decision under the policy and the law; alerts never hold a payment.
The liaison files the approved referral on the state's form; nothing is sent from the solution. Every search, expansion, agent run and decision lands on an audit trail that cannot be edited.
Design targets, to be measured in a pilot
Minutes
to draw and source a ten-claim ring, instead of manual cross-checking across files.
Design target, not a measured result
11 → 1
eleven claims seen as one ring, not eleven separate files.
Demo case, fictional sample data
Every link
traced to the claim and the document it came from.
Design target
13 · What goes in and out
Claims and documents in, cited rings and leads out, with a person deciding in between
In shortIt reads the claims, documents and payment records you already hold, and changes none of them. What comes out is a ranked list of rings, the proof behind every link, and leads your investigators can decide on.
Claims data
Claims, parties, policies, payments and reserves, read nightly
Premium and payout records, with card and account keys your privacy rules allow
Provider, attorney, tow yard and body shop details with identifiers
Claim documents
First-notice call logs
PIP applications and clinic intake forms
Medical bills
Letters of representation
Police reports, tow invoices and repair estimates
What you already know
Your watch list, with a reason on every entry
Industry database and NICB results, with their source
Agents read, match, draw, draftEvery identifier read with its line, name variants matched, hubs set aside, rings drawn each night
People decide every lead and referral
No payment held because of a link
Outputs
Rings found each night, ranked, with why each was flagged
A link map where every line opens its document
Cited answers to plain-words questions
Uncertain name matches, for a fraud analyst
Draft case leads with a timeline, numbered exhibits and open questions
Watch-list alerts to the investigator and the adjuster
Cleared groups kept on record, with a reason
What changes for the team
Eleven claims seen as one ring, not eleven files
The page behind each link opens in one click
An honest household cleared once, not re-flagged every month
An audit trail that cannot be edited records every search, map expansion, agent run and decision.
14 · With what you already run
It works beside your claims, SIU case and fraud scoring systems
In shortKeep your claims system, SIU case management, fraud scores and charting tools. The new piece is the cross-claim view, read from the documents, with a citation on every link.
Core claims system
Claims, parties, policies, payments and reserves are read nightly. Claim decisions stay with the adjuster in the claims system.
SIU case management
An approved lead opens as a case with its summary, timeline and numbered exhibits; the investigator works it where they always do.
Fraud scoring and rules engines
Existing scores and rule alerts sit beside the links: scores rank single claims, links show the groups they belong to.
Industry databases and bureau reporting
Industry claims database and NICB results are stored with their source. Referrals are prepared for each state's form and filed by your liaison.
Link-analysis and charting tools
Charts your analysts already build keep their place; the map exports its links with their citations.
Document management
First-notice logs, intake forms, medical bills, letters and invoices are read where they are stored, and every link opens the page it came from.
Billing and payment systems
Premium and payout records supply card and account keys for matching, under your privacy rules. No payment is ever held by an agent.
Three principles of automated fraud network analysis
1
Read the documents, cite every link
Identifiers come from the call logs, forms, bills and letters, and each link opens its source line.
2
A link is a reason to look
Agents read, match, draw and draft. Investigators decide leads, managers approve referrals, analysts own the rules, adjusters keep the claim.
3
Beside your systems, not instead of them
Claims, SIU case management and scoring stay in place. Agents add the cross-claim view and hand over leads.
Built on Botminds
One platform for agents, data and screens
Builder: describe the work, get a spec, build it, test it.
Runtime: agents, data, integrations, screens and models, in one place.
SecureIsolatedGovernedTestedScalableHighly available
Enterprise-ready
Roles and separation of duties: investigators decide leads, managers approve referrals, agents never send
Maker-checker on rule, weight and hub changes
An unedited audit trail of every search, agent run and decision
Integrations with claims, SIU case, scoring, document and payment systems
Single sign-on, claim-file access rules, service levels and support
Part C · Are you ready to automate?
Should you automate fraud network analysis? A buyer's view
You run the SIU, or you sponsor it, or you pay for its losses. This part is written for you: what organized fraud costs today, what automating the cross-claim view could return, whether your team is ready, and what to ask any vendor, including us.
15 · What fraud costs you
What rings cost before anyone sees them, and how to measure your own
In shortNo published benchmark exists for how long a ring takes to chart or how many are missed. Start from your own numbers. Once you trust them, you can judge any solution against them, ours included.
$45B
a year: the estimated cost of fraud in US property and casualty insurance, plus $34 billion in workers' compensation, within $308.6 billion across all lines.1
Coalition Against Insurance Fraud, 2022 study
2,400 h
a year to chart rings by hand, if your SIU charts 40 rings and each takes 60 hours. These are the calculator's starting guesses, not a benchmark: replace them with yours.
Illustrative arithmetic: 40 × 60
30 days
In Florida, PIP benefits are overdue if not paid within 30 days of written notice, unless the insurer has reasonable proof it is not responsible. The clock runs while the SIU looks.19
Florida Statutes §627.736
Find your own numbers
Cost
Where it hides
How to find your number in a week
Charting rings
Investigators cross-checking call logs, forms and bills by hand
Time your last three rings, from first suspicion to a referral-ready file
Paid before found
Claims settled before anyone saw the group
For those rings, how much was paid and how much still reserved when the ring was seen
Match review
An analyst deciding whether two records are one person
Count uncertain matches a month; time ten of them
Referrals
Rings that arrive as single-claim referrals and are closed alone
Count referrals by source, and how many became cases
False alarms
Honest households and busy clinics flagged again and again
Count groups you cleared last year that came back
Costs no calculator counts
Rings moveOnce noticed, a ring switches to a new clinic, phone or name. Seen late, it is seen in its old form.
Honest customersA family that shares an address, or a patient of a busy clinic, flagged every month, is treated unfairly.
Regulator questions29 jurisdictions have adopted the NAIC AI bulletin, which names fraud detection in scope.21
Referral clocksEach state sets its own deadline and form: 30 days in New York and Texas, 60 in California.101112
Your best investigatorsTheir time goes to finding pages instead of questioning, deciding and building the case.
16 · Your return
What automating the cross-claim view could return for you
In shortPut in your own numbers. Every default below is an illustrative guess, not a benchmark: replace it with yours, and set a lever to 0 if it does not apply.
The value levers
Investigator capacity
Rings charted in minutes
Agents read, match and draw; investigators question, decide and build the case.
rings × hours per ring × share removed × hourly cost
Earlier detection
Found while still reserved
A ring found earlier is found while more of its dollars are reserve, not payment. Payment decisions stay with people after investigation.
rings found earlier × reserve still open × share avoided after investigation
Analyst time
Faster match review
Uncertain matches arrive with both records and their sources side by side.
matches reviewed × minutes saved × hourly cost
Referral quality
Packages that read well
Leads with a timeline, numbered exhibits and neutral wording, ready for the manager and the liaison.
referrals accepted ÷ referrals sent
Fairness
Fewer honest claims re-flagged
Hubs and cleared groups are set aside with a reason and stay on record.
groups cleared and not re-flagged ÷ groups cleared
Governance
A record a regulator can read
Every link cited, every decision by a named person, every search logged.
decisions with full citations ÷ decisions
The calculator
Every default below is an illustrative assumption, not a benchmark, a result or a promise. Replace each with your own number, and set a lever to 0 if it doesn't apply to you.
A · Investigator timeB · Earlier detectionC · Analyst match reviewPayback
Illustrative yearly value
A · Investigator time$0
B · Earlier detection$0
C · Analyst match review$0
Total$0
Investigator hours freed a year0
Payback (months)–
Formulas, per year: A = rings × hours per ring × share removed × hourly cost. B = rings found earlier × reserve still open per ring × share not paid after investigation. C = matches × minutes saved ÷ 60 × analyst hourly cost. Payback = annual cost ÷ (A + B + C) × 12.
No published benchmark exists for hours per ring, detection rates or ring size: use your own measures (the working-session questions in section 19, G1 and G2). Lever B counts only amounts a person decides not to pay after a reasonable investigation; a link alone never stops a payment. Not counted: referral quality, fairness and governance.
Start here17 · Readiness check
Are you ready to automate? Nine questions, five minutes
In shortPick the answer closest to your SIU today. Eight questions score 0 to 2; the last is for reflection. The meter adds them up as you go. Each question says why it matters and what a strong answer looks like.
1
Claims data
Can you pull every claim, party, policy, payment and reserve for the last 24 months in one extract?
Why it mattersRings run over months, across lines and units. A link map is only as wide as the claims it can see.
A strong answer"Claims, parties, policies, payments and reserves load nightly into one store, 24 months back."
2
Documents
Are claim documents (first-notice logs, intake forms, medical bills, letters of representation, invoices) stored digitally and attached to the claim?
Why it mattersThe strongest links (the callback phone, "referred by", the billing address) live inside documents, not fields.
A strong answer"Every document is in the claim file, searchable, with its received date."
3
Payments
Can premium payments and claim payouts (card, bank account, payee) be joined to claims and policies?
Why it mattersOne card paying many new policies, or one account receiving many settlements, is among the strongest links there is.
A strong answer"Billing and disbursement data carry tokenized card and account keys we can join on."
4
Providers
Do you keep provider, attorney, tow and repair-shop details with stable identifiers (NPI, tax ID, license, address)?
Why it mattersClinics change names; identifiers and billing addresses don't change as easily. Two clinics at one suite under two tax IDs shows only if you keep both.
A strong answer"A maintained vendor and provider table with NPI, tax ID and billing address."
5
Referral
Does your SIU have a written referral process with each state's clock, form and recipient?
Why it mattersDeadlines differ: 30 days in New York and Texas, 60 in California, no day count in Florida. One national number is wrong somewhere.
A strong answer"A referral table by state, with the clock, the form and who files, reviewed every year."
6
People
Do you have a fraud analyst who can own link rules, weights, hubs and uncertain name matches?
Why it mattersSomeone has to decide that a hospital is a hub, that a household is not a ring, and that two records are the same person.
A strong answer"A named fraud analyst with time set aside for rules and match review."
7
AI governance
Do you have a written AI governance program that covers fraud detection, with human review of final decisions?
Why it mattersThe NAIC model bulletin names fraud detection in scope and expects a written program, human involvement and documented controls.
A strong answer"Our AI program lists our fraud models and tools, their owners, their controls and their vendors."
8
Claims and SIU
Do adjusters and the SIU share a watch-list and alert process, with a rule that alerts never hold a payment by themselves?
Why it mattersA new claim from a known phone should reach the investigator and the adjuster the same day, while the claim is handled under fair-claims rules.
A strong answer"Watch-list hits alert both; the adjuster decides the claim; every alert and outcome is logged."
9
Vision · for reflection
If an adjuster flagged one PIP claim this morning, what would it take to know by lunchtime every other claim its caller, clinic, attorney and card touch, with the document behind each link?
Why it mattersYour answer lists the blockers. Each one is a candidate job for an agent: reading a document, matching a name, drawing a link or drafting a lead.
A strong answerA short, specific list, for example "document access, provider IDs and one place to ask."
What your score means
0–6
Build the foundation
Start with data and rules: one claims extract with its documents, provider identifiers, and a written referral table by state. Name a fraud analyst. Measure how long your last few rings took to chart.
7–11
Ready with groundwork
Connect the one or two missing sources (often documents or payment keys), write the "no action on a link alone" rule, then run a measured pilot on a past ring and a live month.
12–16
Ready to pilot
Run fraud network analysis beside your current SIU process for one quarter. Measure time to chart, leads opened, referrals accepted, groups cleared, and how early the links were visible.
18 · Questions for any vendor
Sixteen questions to ask before you buy fraud ring detection software
In shortAsk every vendor the same questions, us included. The answers show how the work is really done: what gets read, what proof you keep, and whether a link can ever hold a payment.
Ask
A good answer
A warning sign
What gets read
Does it read claim documents, or only fields?
Call logs, intake forms, bills, letters and invoices, each link tied to its line
Only the structured fields in the claims system
How far back, and across which lines?
24 months or more, every line of business in one map
One line at a time, one quarter at a time
How does it match names written differently?
A confidence on every match; uncertain ones go to a person; never across different dates of birth
Exact match only, or everything merged automatically
How does it handle hospitals and our own phone lines?
Set aside as hubs, each with a reason you can see and change
One giant ring, or hubs hidden in code
Proof
For each link, can I open the document and the line?
One click from the link to the page it was read from
A score with no source
Can it explain why a ring was flagged?
Named facts, each with its points and the claims it covers
A number nobody can explain
Control
Can a link hold a payment, deny a claim or contact anyone?
No. Alerts only; the adjuster keeps the claim
"High scores are suspended automatically"
Who approves leads and referrals?
The investigator saves the lead, the SIU manager approves, the liaison files
The system sends referrals itself
Who can change weights, hubs and thresholds?
A fraud analyst, with a second approver, every version kept
The vendor, with no record
What happens to a group we clear?
Kept on record with its reason, and not flagged again
Deleted, and flagged again next month
Governance and data
Does it support our AI governance program?
Documented controls, human review of decisions, and records a regulator can ask for
"The model is proprietary"
Is every search logged, and are claim-file access rules kept?
Logged by user; people see only what they may see in the claim file
Everyone sees everything
Where does claim data live, and is it used to train anything?
Isolated to your company; not used for training, in writing
Shared environments, vague answers
Fit and proof
Does it work with our claims, SIU case and scoring systems?
It reads them and hands approved leads to your case system
Case management must be replaced first
Will you replay a past ring of ours?
Yes, measured: how early the links were visible, and time to chart
Demo data only
What does the price depend on?
A clear unit, such as claims or users, and what is included
A number that appears only after the contract
19 · How to start
How to start: five steps to a decision you can defend
In shortMeasure first, then replay a ring you already know, then decide with numbers. None of these steps commits you to a vendor.
Time your last three rings, from first suspicion to a referral-ready file. No published benchmark exists, so this is the number a pilot is measured against.
Count your referral funnel: referrals a month, from where, and how many became cases.
Pick one past ring to replay, and gather its claim files and documents, with an approval path from legal and privacy.
Run beside your SIU for one quarter, on the past ring and a live month. People decide every lead; no payment is held.
Decide with numbers: time to chart, leads opened, referrals accepted, groups cleared, and how early the links were visible.
The full working-session questions: 37 questions in eleven groups
A
Data: claims and parties
A1
Which lines and units feed the claims extract: personal and commercial auto, PIP, homeowners, workers' comp?
Why it mattersRings cross lines; a roofer on home claims can share a phone with an auto claim.
Strong answer · warning sign
All lines, one extract.
Each line in its own silo.
A2
Are passengers, witnesses, callers and payees stored as parties, or only in notes?
Why it mattersThe caller and the witness are often the link; if they live only in notes, they must be read out.
Strong answer · warning sign
Parties with roles and contact details.
"It's in the adjuster's notes somewhere."
A3
How far back can you look, and is closed-claim data kept with its documents?
Why it mattersRings repeat over seasons; a 24-month look-back catches patterns a quarter misses.
Strong answer · warning sign
24 months or more, documents included.
Closed claims archived off-line.
A4
Are policy inception, binding channel and agent recorded, so "bound shortly before the loss" can be measured?
Why it mattersNew policies bound just before a loss and paid the same way are a premium-fraud link.
Strong answer · warning sign
Bind date, channel and payment on every policy.
Only the effective date.
B
Data: documents and adjuster notes
B1
Are first-notice calls logged with the callback number and the caller's relation to the insured?
Why it mattersA "friend of the driver" calling on many claims is a strong early link.
Strong answer · warning sign
Structured call log with callback and relation.
Recording only, no notes.
B2
Do medical bills arrive as data (with box 33 billing provider) or as images?
Why it mattersThe billing address and tax ID reveal clinics that share a back office.
Strong answer · warning sign
Bill data plus images, both kept.
Images only, never read.
B3
Are letters of representation, intake forms, police reports and tow invoices kept in the claim file and searchable?
Why it matters"Referred by", the attorney and the tow yard are written there, not in fields.
Strong answer · warning sign
Indexed and searchable.
Scanned into a general folder.
C
Data: payments, bank and card details
C1
Can you see which card or account paid each premium, in a form you are allowed to use for fraud detection?
Why it mattersOne card behind many policies in different names is a premium-fraud pattern.
Strong answer · warning sign
Tokenized keys, approved for fraud use.
Held by a payment processor we can't query.
C2
Are settlement accounts and payees recorded for every disbursement?
Why it mattersOne account receiving settlements in several names is a theft-ring link.
Strong answer · warning sign
Payee and account on every payment.
Checks with payee name only.
D
Data: providers, attorneys, tow yards and shops
D1
Do you keep NPI, tax ID, license and billing address for every provider, and update them?
Why it mattersStable identifiers survive a clinic's change of name.
Strong answer · warning sign
A maintained table.
Typed fresh on each bill.
D2
Are attorneys, tow yards, body shops, appraisers and public adjusters recorded as entities, not free text?
Why it mattersThe attorney–clinic–tow–shop network shows only if each is one entity.
Strong answer · warning sign
Entities with IDs.
Spelled differently on every claim.
E
Data: watch lists and data sharing
E1
Is there a watch list of phones, people, providers, shops, cards and accounts, with who added each entry and why?
Why it mattersA watch list without reasons becomes a blacklist; with reasons, it is a record.
Strong answer · warning sign
Entries with reason, owner and review date.
A spreadsheet nobody owns.
E2
How do you use industry claims databases and NICB, and can those results be joined to your own links?
Why it mattersRings cross carriers; your map should show what industry data adds, with its source.
Strong answer · warning sign
Results stored with the claim, cited.
Searched by hand, results in notes.
E3
What does your legal team allow you to share, and with whom (other carriers, NICB, the state bureau)?
Why it mattersModel 680 grants immunity for good-faith reports, but sharing beyond that needs a rule.
Strong answer · warning sign
A written data-sharing policy.
Decided case by case.
F
Entity resolution quality
F1
How many duplicate parties and providers do you estimate in your data, and has anyone measured it?
Why it mattersDuplicates hide links; over-merging creates false ones.
Strong answer · warning sign
Measured on a sample.
"We don't have duplicates."
F2
Are addresses and phones standardized (suite formats, area codes, punctuation)?
Why it matters"Ste 210" and "Suite 210" must be one place.
Strong answer · warning sign
Standardized on intake.
Stored as typed.
F3
How often is date of birth captured for claimants and passengers?
Why it mattersA date-of-birth clash is the safest "never merge" rule; without it, matches carry more doubt.
Strong answer · warning sign
Captured on most injury claims.
Rarely captured.
F4
Who reviews uncertain matches, and how quickly?
Why it mattersAn uncertain match left unreviewed is either a missed link or a false one.
Strong answer · warning sign
A fraud analyst, daily.
Nobody; matches are auto-accepted.
G
SIU process and referral
G1
How long does it take your team to chart a ten-claim ring today, from first suspicion to a referral-ready file?
Why it mattersNo published benchmark exists. Your own baseline is the number a pilot will be measured against.
Strong answer · warning sign
Measured on recent cases.
"It depends," with no example.
G2
How many referrals reach the SIU each month, from where, and how many become cases?
Why it mattersThe funnel shows whether rings arrive as single-claim referrals that are closed alone.
Strong answer · warning sign
A count at each stage, by source.
Only closed-case totals.
G3
How do you track each state's referral clock, form and the date detected and reported?
Why it mattersFlorida's rule asks for both dates; New York, Texas and California count days.
Strong answer · warning sign
Tracked per case, per state.
Calendar reminders.
G4
What does your law-enforcement liaison need in a package: timeline, numbered exhibits, a summary in neutral words?
Why it mattersA lead drafted in that shape saves the liaison's time and reads well with prosecutors.
Strong answer · warning sign
A template the liaison wrote.
Rebuilt for every case.
G5
How are cleared groups and false positives recorded, so they are not flagged again?
Why it mattersRe-flagging an honest household every month wastes time and is unfair to it.
Strong answer · warning sign
Cleared with a reason, kept on record.
Deleted or forgotten.
H
Governance, privacy and fair-claims rules
H1
Is it written that no payment is held, no claim denied and no one contacted because of a link alone?
Why it mattersFair-claims law requires a reasonable investigation; regulators expect human involvement in AI-assisted decisions.
Strong answer · warning sign
Written, and built into the tools.
"The adjusters know."
H2
Which of your states have adopted the NAIC AI model bulletin, and does your AI program list fraud tools and their vendors?
Why it matters29 jurisdictions had adopted it by October 8, 2026, and regulators may ask for the program and vendor contracts.
Strong answer · warning sign
A state list and an inventory.
Nobody owns the question.
H3
Do you write in Colorado, and has your counsel assessed claims and fraud models under its rules?
Why it mattersColorado's governance rules cover private passenger auto insurers, with full compliance due July 1, 2026.
Strong answer · warning sign
Assessed and documented.
Not considered.
H4
Is every search of personal data logged by user, and does the tool honor claim-file access rules?
Why it mattersLink analysis touches sensitive data; need-to-know must be provable.
Strong answer · warning sign
Logged, and access inherited from the claim file.
Everyone sees everything.
H5
Have privacy and legal approved which identifiers may be used for matching (for example, no biometrics)?
Why it mattersSome identifiers carry their own legal duties; decide before you match on them.
Strong answer · warning sign
An approved list of match keys.
"Whatever's in the data."
I
Systems
I1
Which core claims system holds claims, parties and payments, and can it be read through an API or nightly feed?
Why it mattersThe map needs fresh claims every night.
Strong answer · warning sign
An API or feed exists.
Screens only.
I2
Where do SIU cases live, and can a lead and its exhibits be opened there as a case?
Why it mattersThe investigator should keep working in the case system they know.
Strong answer · warning sign
Case creation by API.
Re-keyed by hand.
I3
Which fraud scores and rules engines run today, and can their alerts be read alongside links?
Why it mattersScores rank single claims; links show groups. Together they tell a fuller story.
Strong answer · warning sign
Scores stored with the claim.
A score nobody can explain.
I4
What identity and access model must a new tool follow: single sign-on, roles, data residency, vendor review?
Why it mattersKnowing the security review early avoids a late stop.
Strong answer · warning sign
A checklist and a named reviewer.
Unknown until procurement.
J
People
J1
How many investigators and analysts do you have, and how many open files does each carry?
Why it mattersCapacity, not suspicion, is often what limits how many rings get worked.
Strong answer · warning sign
Known, with a backlog count.
"Everyone is busy."
J2
Who owns this internally (SIU director, chief claims officer), and who funds it?
Why it mattersWork that spans claims, SIU, billing and IT stalls without one owner.
Strong answer · warning sign
A named owner and a budget line.
Nobody owns it end to end.
J3
Who would run a pilot, and how would it be measured (time to chart a ring, leads opened, referrals accepted, groups cleared)?
Why it mattersA measured pilot settles the decision.
Strong answer · warning sign
Baseline and measures agreed up front.
"Let's see what it finds."
K
Vision
K1
What if every new first-notice call from a phone you are watching reached the investigator and the adjuster the same morning?
Why it mattersTests appetite for earlier, shared alerts that never hold a payment.
Strong answer · warning sign
"We'd see the next claim before it's paid."
Alerts would go unread; find out why.
K2
Which ring from the last year would you most like to replay, to see how early its links were visible?
Why it mattersA concrete case makes a pilot real and measurable.
Insurance fraud network analysis, or link analysis, looks at claims together instead of one at a time. It connects the people, phones, addresses, clinics, attorneys, tow yards, shops, cards and accounts that claims share, so an organized fraud ring shows up as one group of claims that share more than chance allows.
How is fraud ring detection different from scoring a single claim?
A claim score rates one claim on its own facts, and a well-run ring keeps each claim ordinary so each scores low. Fraud ring detection looks across claims for dense groups linked by shared phones, providers, attorneys, cards and accounts, with hubs such as hospitals set aside. The two work best together.
How do staged accident rings work?
Common schemes include the swoop and squat, where one car cuts in and another brakes hard so the victim rear-ends it; the drive-down, where a driver waves the victim into a turn and then hits them; paid passengers; and paper accidents that never happened. Participants are often steered to the same clinics and attorneys, and NICB warns of tow trucks that arrive uncalled.
What are runners and cappers?
Runners and cappers are recruiters paid per patient or per case to steer crash victims, or staged-crash participants, to particular clinics and attorneys. In one federal New York case, the organizer even bribed hospital staff and 911 dispatchers for accident victims' details.
What is entity resolution in insurance fraud investigation?
Entity resolution decides when records written differently are the same real person, phone, address or business: a full name, an initial and a nickname on one phone; "Ste" and "Suite" on one address. Good practice merges automatically only above a high confidence, sends uncertain matches to a fraud analyst, and never merges across conflicting dates of birth.
What does an insurance special investigations unit (SIU) do?
An SIU receives red flags from adjusters, rules, scores and industry databases; investigates with documents, recorded statements, examinations under oath and records checks; decides whether there is a case; and refers suspected fraud to the state fraud bureau and, through a liaison, to law enforcement. Many states require insurers to run anti-fraud programs or units.
When must an insurer report suspected fraud, and to whom?
To the state's insurance fraud bureau, as each state prescribes; there is no single national deadline. As of October 2026, for example, New York and Texas require a report within 30 days and California within 60 days. Florida sets no day count but requires reporting to its Division of Criminal Investigations on Form DFS-L1-1691. Check current law with counsel.
Is an NICB questionable claim the same as fraud?
No. A questionable claim is a referral by an NICB member for review. NICB itself notes that a questionable claim does not automatically equate to a fraudulent claim.
How much does insurance fraud cost?
The Coalition Against Insurance Fraud's 2022 study estimates $308.6 billion a year in the US across all lines, including about $45 billion in property and casualty insurance and $34 billion in workers' compensation; about $68.7 billion of the total is Medicare and Medicaid.
Can AI deny a claim because it is linked to a fraud ring?
It should not. Fair-claims law treats refusing to pay without a reasonable investigation as an unfair practice, and the NAIC model bulletin on AI, adopted by 29 jurisdictions as of October 2026, expects human involvement and documented controls. In the Botminds solution, a link is a reason to look: no payment is held, no claim is denied and no one is contacted because of a link.
How are hospitals and our own call center kept from linking everyone?
They are set aside as hubs before rings are drawn: anything linked to an unusually large number of claims, the insurer's own phone numbers and addresses, and national tow and glass dispatch lines. Each hub is recorded with its reason, and a fraud analyst approves changes.
Does it replace our fraud scoring or SIU case management software?
No. It works beside your claims system, SIU case management, fraud scores and charting tools. It reads their data and the documents behind it, draws the cited link map, and hands approved leads and exhibits to the case system your team already uses.
What data does fraud network analysis need?
Claims and parties, claim documents such as first-notice logs, intake forms, medical bills, letters of representation and invoices, premium and payout records, provider, attorney and shop details with identifiers, and your watch lists. The more of it is digital and joinable, the more links appear.
How do we get started?
Take the five-minute readiness check in this guide, see the solution working on real screens, then try a walkthrough on a past ring of your own to see how early its links were visible. Go-live follows your requirements and data connections, and is tested before it reaches your investigators.
Can we pull 24 months of claims, parties, payments and reserves in one extract?
Are claim documents digital and attached to every claim?
Can premium payments and payouts be joined to claims?
Do we keep provider, attorney and shop details with identifiers?
Is our referral process written by state: clock, form, recipient?
Does a fraud analyst own link rules and uncertain matches?
Does our written AI program cover fraud detection, with human review?
Do adjusters and the SIU share watch-list alerts that never hold a payment?
What would it take to see, by lunchtime, every claim one flagged claim's links touch?
Score 0–2 on 1–8: 0–6 build the foundation · 7–11 ready with groundwork · 12–16 ready to pilot.
12 terms
SIU
The insurer's special investigations unit.
Link analysis
Claims and what they share, drawn as a network.
Entity resolution
Matching differently written records to one entity.
Ring
Claims sharing more than chance allows; a reason to look.
Hub
An entity linking many honest claims, set aside.
Link weight
How strongly a shared item suggests connection.
FNOL
First notice of loss, often a call with a callback number.
PIP
No-fault injury coverage from the insured's own policy.
Swoop and squat
A staged rear-end crash.
Runner, capper
A paid recruiter steering victims to clinics and lawyers.
Medical mill
A clinic billing boilerplate treatment, often secretly controlled.
Reasonable belief
The usual trigger for a mandatory fraud report.
22 · Sources
Sources and dates
Every statistic in this guide links here. Regulatory statements are as of October 2026; rules change, so check the current text before relying on them.
Coalition Against Insurance Fraud, "The Impact of Insurance Fraud on the U.S. Economy," prepared by the Colorado State University Global White Collar Crime Task Force, August 26, 2022 (figures as of 2022; pp. 9–10 on the origin of the 10% estimate). insurancefraud.org (PDF)
Insurance Information Institute, "Background on: Insurance fraud" (state program requirements; 2019 CAIF technology study). iii.org
Coalition Against Insurance Fraud, fraud statistics page (about 10% of P&C losses, a long-standing estimate). insurancefraud.org
NICB presentation to the South Carolina House Insurance Rate Review Ad Hoc Committee, June 11, 2025. scstatehouse.gov (PDF)
We use essential cookies to make this site work, and cookieless, anonymised analytics to understand how it's used. "Accept all" also turns on Google Analytics, which sets cookies. Privacy policy